12 vulnerabilities published for NLTK (Python), topped by a critical missing integrity check on downloaded packages before extraction and an RCE in AllowlistUnpickler. Remaining issues are mostly sandbox and path-traversal escapes in corpus readers – symlink escapes in CorpusReader.open() and FramenetCorpusReader, arbitrary local file read in StreamBackedCorpusView, SSRF, unbounded recursion in JSONTaggedDecoder, and security checks disabled by default.

Upgrade nltk to 3.10.3.